CVE-2026-84742

The Events Calendar WordPress plugin, affecting versions 6.15.0 through 6.17.4 , contains an incorrect authorization vulnerability. The plugin fails to verify the necessary capabilities required to publish content when creating or updating entries via its REST API . This allows users with restric...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

WordPress The Events Calendar plugin 6.15.0-6.17.4 - Contributor+ Content Publication vulnerability

Contributor+ Content Publication vulnerability discovered by Jashid Sany in WordPress Plugin The Events Calendar versions 6.15.0-6.17.4...

PT-2026-97457

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

PT-2026-97336

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2 Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

PT-2026-97177

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0 Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or high...

PT-2026-97202

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 2.1.4 Description Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the eval function on user-controlled block content withi...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-93507: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-88997: Improper Neutralization of Input During Web Page Generation

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

PT-2026-97443

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.1.8 Description An Insecure Direct Object Reference IDOR exists within the contributor functionality. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based o...

PT-2026-97471

Name of the Vulnerable Software and Affected Versions Podcast Importer SecondLine versions prior to 1.5.7 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than...

CVE-2026-85006: Improper Neutralization of Input During Web Page Generation

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

PT-2026-97468

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.6 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to properly sanitize...

PT-2026-97456

Name of the Vulnerable Software and Affected Versions Premium Blocks – Gutenberg Blocks for WordPress versions prior to 2.3.18 Description An issue exists that allows a user with contributor privileges to perform Cross Site Scripting XSS, a technique where malicious scripts are injected into...

PT-2026-97462

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

PT-2026-97196

Name of the Vulnerable Software and Affected Versions The Event Booking Manager for WooCommerce versions prior to 5.7.3 Description The plugin fails to restrict its event listing query to events that the requesting user is authorized to view. Consequently, users with contributor-level access or...